PatchTheCVECVE-2022-4603: A vulnerability classified as problematic has been found in ppp
CVE-2022-4603 is a medium-severity flaw (CVSS 4.3) affecting ppp, ppp. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-21
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.3 (Medium) |
| Attack vector | Adjacent network |
| Attack complexity | High |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 0.9% (top 41%) |
| CISA exploited list | No |
| Weakness | CWE-119 |
| Published | 2022-12-18 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-4603?
ppp: upgrade to 2.5.0; ppp: upgrade to 2.5.0. Exact commands for each OS are on this page.
Is CVE-2022-4603 being exploited?
CVE-2022-4603 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-4603 affect?
CVE-2022-4603 affects ppp, ppp. Severity is medium (CVSS 4.3). A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of arr
How urgent is CVE-2022-4603?
Priority 30/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2020-15704 MEDIUM 5.5 MITIGATE The modprobe child process in the ./debian/patches/load_ppp_generic_if_needed patch file incorrectly handled m
- CVE-2008-5366 MEDIUM 6.9 DOWNGRADE The postinst script in ppp 2.4.4rel on Debian GNU/Linux allows local users to overwrite arbitrary files via a